CVE-2021-24423

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

4.8MEDIUM

EPSS

0.2%

top 57.07%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Unknown Updraftplus Wordpress Backup Plugin Updraftplus Updraftplus

Timeline

PublishedJan 24

Latest updateJan 25

Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/updraftplus_wordpress_backup_plugin1.6.59 — 1.6.59

▶NVDupdraftplus/updraftplus< 1.16.59

🔴Vulnerability Details

GHSA

GHSA-4v9q-rjxq-3952: The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1↗2022-01-25

▶

CVEList

UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site Scripting↗2022-01-24

▶